CVE-2026-79675

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3

Description Insufficient validation of JVM options passed through the options parameter in the java() function allows the injection of dangerous JVM flags. By supplying malicious options such as -agentpath, -javaagent, or @argfile to Stanford wrapper classes, an attacker can achieve arbitrary code execution.

Recommendations Update to version 3.10.3 or later. As a temporary mitigation, restrict or avoid passing untrusted input to the options parameter of the java() function.